Suspicious Mshta.EXE Execution Patterns

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects suspicious execution patterns of mshta.exe, a Microsoft HTML Application host. It specifically looks for mshta.exe being spawned by common scripting or system utilities (cmd.exe, powershell.exe, cscript.exe, wscript.exe, regsvr32.exe, rundll32.exe) or when mshta.exe is executed from suspicious directories like AppData, ProgramData, Users\Public, or Windows\Temp. The rule also flags executions involving .htm or .hta files in the command line, while filtering out legitimate executions from System32 or SysWOW64 directories.